Methods of securely controlling through one or more separate private networks an internet-connected computer having one or more hardware-based inner firewalls or access barriers

ABSTRACT

A method of securely controlling through a private network a computer protected by a hardware-based inner access barrier or firewall and optionally configured to operate as a general purpose computer connected to the Internet, comprising: two separate network connections separated by an inner hardware-based access barrier or inner hardware-based firewall protecting a private network connection configured for connection to a private network of computers but not protecting a public network connection configured for connection to a public network configured to include the Internet, the method including the step of controlling at least one operation of the computer, the control being provided through the private network and the operation involving data and/or code transmitted to the public network. Another method includes the step of controlling an operation of a second or third private protected unit of the computer, the control being provided through a second or third private network, respectively.

This application is a nonprovisional of U.S. provisional app. no.61/457,265, filed Feb 15, 2011, and a continuation of PCT/US2011/025257,filed Jan. 26, 2011, which, in turn, is a nonprovisional of U.S.provisional app. nos. 61/457,184, filed Jan. 24, 2011; 61/344,018; filedMay 7, 2010, 61/282,861, filed Apr. 12, 2010; 61/282,503, filed Feb. 22,2010 and 61/282,478, filed Feb. 17, 2010. PCT/US2011/025257 is also acontinuation-in-part of U.S. application Ser. No. 13/016,527, filed Jan.28, 2011, which, in turn, is a nonprovisional of U.S. provisional app.Nos. 61/457,184, filed Jan. 24, 2011; 61/344,018; filed May 7, 2010,61/282,861, filed Apr. 12, 2010; 61/282,503, filed Feb. 22, 2010;61/282,478, filed Feb. 17, 2010; and 61/282,378, filed Jan. 29, 2010.PCT/US2011/025257 is also a continuation-in-part of U.S. applicationSer. No. 13/014,201, filed Jan. 26, 2011, which, in turn, is anonprovisional of U.S. provisional app. nos. 61/457,184, filed Jan. 24,2011; 61/344,018; filed May 7, 2010, 61/282,861, filed Apr. 12, 2010;61/282,503, filed Feb. 22, 2010; 61/282,478, filed Feb. 17, 2010;61/282,378, filed Jan. 29, 2010; 61/282,337, filed Jan. 26, 2010. Thecontent of each and every one of the foregoing patent applications ishereby incorporated by reference in its entirety.

BACKGROUND OF THE INVENTION

This invention relates to any computer of any form, such as a personalcomputer and/or microchip, that has an inner hardware-based accessbarrier or firewall that establishes a private unit that is disconnectedfrom a public unit, the public unit being configured for a connection toa insecure public network of computers including the Internet. Inaddition, the computer's private unit is configured for a separateconnection to at least one secure non-Internet-connected private networkfor administration, management, and/or control of the computer and/ormicrochip, locally or remotely, by either a personal user or a businessor corporate entity.

More particularly, this invention relates to a computer and/or microchipwith an inner hardware-based access barrier or firewall separating theprivate unit that is not connected to the Internet from a public unitconnected to the Internet, the private and public units being connectedonly by a hardware-based access barrier or firewall in the form of asecure, out-only bus or equivalent wireless connection. Even moreparticularly, this invention relates to the private and public unitsalso being connected by an in-only bus (or equivalent wirelessconnection) that includes a hardware input on/off switch or equivalentsignal interruption mechanism, including an equivalent circuit on amicrochip or nanochip (or equivalent wireless connection). Still moreparticularly, this invention relates to the private and public unitsbeing connected by an output on/off switch or microcircuit ornanocircuit equivalent on the secure, out-only bus (or equivalentwireless connection).

In addition, this invention relates to a computer and/or microchip thatis connected to a another computer and/or microchip, the connectionbetween computers being made with the same hardware-based accessbarriers or firewalls including potentially any of the buses and on/offswitches described in the preceding paragraph.

Finally, this invention relates to a computer and/or microchip withhardware-based access barriers or firewalls used successively between anouter private unit, an intermediate more private unit, an inner mostprivate unit, and the public unit (or units), with each private unitpotentially being configured for a connection to a separate secureprivate network. Also, Faraday Cage protection from externalelectromagnetic pulses for part or all of the computer and/or microchipcan be provided.

By way of background, connecting computers to the Internet has immenseand well know benefits today, but also has created overwhelming securityproblems that were not imagined when the basic architecture of modernelectronic computers was developed in 1945, which was about twenty yearsbefore networks came into use. Even then, those first networks involveda very limited number of connected computers, had low transmissionspeeds between them, and the network users were generally known to eachother, since most networks were relatively small and local.

In contrast, the number of computers connected to the Internet today isgreater by a factor of many millions, broadband connection speeds arefaster by a similar magnitude, the network connections stretch worldwideand connect to hundreds of thousands of bad actors whose identity is noteasily or quickly known, if ever. Indeed, the Internet of today allowsthe most capable criminal hackers direct access to any computerconnected to the Internet. This inescapable reality of the Internet hascreated a huge and growing threat to military and economic securityworldwide. At the same time, connection to the Internet has become thecommunication foundation upon which both the global economy andindividual users depend every day.

In summary, then, computer connection to the Internet is mandatory intoday's world, so disconnection is not a feasible option, given theexisting global dependence on the Internet. But those unavoidableconnections have created a seemingly inherent and therefore unsolvablesecurity problem so serious that it literally threatens the world. SoInternet connection today is both unavoidable and unavoidably unsafe.

Past efforts to provide Internet security have been based primarily onconventional firewalls that are positioned externally, physically and/orfunctionally, between the computer and an external network like theInternet. Such conventional firewalls provide a screening or filteringfunction that attempts to identify and block incoming network malware.But because of their functionally external position, conventionalfirewalls must allow entry to a significant amount of incoming traffic,so either they perform their screening function perfectly, which is animpossibility, or at least some malware unavoidably gets into thecomputer and just a single instance of malware can cause a crash orworse. Once the malware is in, the von Neumann architecture of currentcomputers provides only software protection, which is inherentlyvulnerable to malware attack, so existing computers are essentiallyindefensible from successful attack from the Internet, which hasprovided an easy, inexpensive, anonymous, and effective means for theworst of all hackers worldwide to access any computer connected to it.

SUMMARY OF THE INVENTION

Therefore, computers cannot be successfully defended without innerhardware or firmware-based access barriers or firewalls that, because oftheir internal position, can be designed much more simply to function asa access barrier or blockers rather than as general filters. An Internetfilter has to screen any network traffic originating from anywhere inthe entire Internet, which is without measure in practical terms and isconstantly, rapidly changing, an incredibly difficult if not impossiblescreening task. In contrast, an access barrier or blocker to an innerprotected area of a computer can strictly limit access to only anexception basis. So, in simple terms, a conventional firewall generallygrants access to all Internet traffic unless it can be identified asbeing on the most current huge list of ever changing malware; incontrast, an inner access barrier or blocker can simply deny access toall network traffic, with the only exception being a carefully selectedand very short and conditioned list of approved and authenticatedsources or types of traffic to which access is not denied.

Such a massively simpler and achievable access blocking functionallowing for a much simpler and efficient mechanism for providingreliable security. Whereas a conventional but imperfect firewallrequires extremely complicated hardware with millions of switches and/orfirmware and/or software with millions of bits of code, thehardware-based access barriers described in this application require aslittle as a single simple one-way bus and/or another simple one-way buswith just a single switch and/or both simple buses, each with just asingle switch. This extraordinarily tiny amount of hardware is at theabsolute theoretical limit and cannot be less.

With this new and unique access denial approach, a computer and/ormicrochip can be simply and effectively defended from Internet malwareattack with one or more hardware-based private, protected units (orzones or compartments) inside the computer. Any or all of these privateunits can be administrated, managed, and/or controlled by a personal orcorporate computer user through the use of one or more separate andsecure non-Internet private networks. By thus avoiding any connectionwhatsoever to the insecure public Internet, connection of the computer'sprivate unit to the secure private network allows for all the well knownspeed, efficiency and cost effectiveness of network connection whilestill completely avoiding the incalculable risk of Internet connection.

This application hereby expressly incorporates by reference in itsentirety U.S. patent application Ser. No. 10/684,657 filed Oct. 15, 2003and published as Pub. No. US 2005/0180095 A1 on Aug. 18, 2005 and U.S.patent application Ser. No. 12/292,769 filed Nov. 25, 2008 and publishedas Pub. No. US 2009/0200661 A1 on Aug. 13, 2009.

Also, this application hereby expressly incorporates by reference in itsentirety U.S. patent application Ser. No. 10/802,049 filed Mar. 17, 2004and published as Pub. No. US 2004/0215931 A1 on Oct. 28, 2004; U.S.patent application Ser. No. 12/292,553 filed Nov. 20, 2008 and publishedas Pub. No. US 2009/0168329 A1 on Jul. 2, 2009; and U.S. patentapplication Ser. No. 12/292,769 filed Nov. 25, 2008 and published asPub. No. US 2009/0200661 A1 on Aug. 13, 2009.

Finally, this application hereby expressly incorporates by reference inits entirety U.S. Pat. No. 6,167,428 issued 26 Dec. 2000, U.S. Pat. No.6,725,250 issued 20 Apr. 2004, U.S. Pat. No. 6,732,141 issued 4 May2004, U.S. Pat. No. 7,024,449 issued 4 Apr. 2006, U.S. Pat. No.7,035,906 issued 25 Apr. 2006, U.S. Pat. No. 7,047,275 issued 16 May2006, U.S. Pat. No. 7,506,020 issued 17 Mar. 2009, U.S. Pat. No.7,606,854 issued 20 Oct. 2009, U.S. Pat. No. 7,634,529 issued 15 Dec.2009, U.S. Pat. No. 7,805,756 issued 28 Sep. 2010, and U.S. Pat. No.7,814,233 issued 12 Oct. 2010.

Definitions and reference numerals are the same in this application asin the above incorporated '657, '769, '049 and '553 U.S. applications,as well as in the above incorporated '428, '250, '141, '449, '906, '275,'020, '854, '529, '756, and '233 U.S. patents.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows any computer of any type or size or design, such as apersonal computer 1 and/or microchip 90 (and/or 501) or nanochip with aninner hardware-based access barrier or firewall 50 establishing aPrivate Unit (or zone or compartment) 53 of the computer or microchipthat is disconnected from a Public Unit (or zone or compartment) 54 thatis connected to the insecure public Internet 3 (and/or another,intermediate network 2 that is connected to the Internet 3). FIG. 1 alsoshows an example embodiment of the Private Unit 53 having at least oneconnection to at least one private and secure non-Internet-connectednetwork 52 for personal or local administration of a computer such asthe personal computer 1 and/or microchip 90 (and/or 501) and/or siliconwafer 1500 (or portion 1501, 1502, and/or 1503), or graphene equivalent.The number and placement of the non-Internet-connected networks 52 isoptional.

FIG. 2 shows an example embodiment similar to that shown in FIG. 1,including a personal computer 1 and/or microchip 90 (and/or 501) with aninner hardware-based access barrier or firewall 50 separating a PrivateUnit 53 disconnected from the Internet 3 and a Public Unit 54 connectedto the Internet 3, but with the Private Unit 53 and Public Unit 54connected only by a hardware-based access barrier or firewall 50 a, forexample in the form of a secure, out-only bus (or wire) or channel 55(or in an alternate embodiment, a wireless connection, including radioor optical).

FIG. 3 is an example embodiment similar to that shown in FIG. 2, butwith the Private Unit 53 and Public Unit 54 connected by ahardware-based access barrier or firewall 50 b example that alsoincludes an in-only bus or channel 56 that includes a hardware inputon/off switch 57 or equivalent function signal interruption mechanism,including an equivalent functioning circuit on a microchip or nanochip.

FIG. 4 is a similar example embodiment to that shown in FIGS. 2 and 3,but with Private Unit 53 and Public Unit 54 connected by ahardware-based access barrier or firewall 50 c example that alsoincludes an output on/off switch 58 or microcircuit equivalent on thesecure, out-only bus or channel 55.

FIG. 5 shows an example embodiment of any computer such as a firstpersonal computer 1 and/or microchip 90 (and/or 501) that is connectedto a second computer such as a personal computer 1 and/or microchip 90(and/or 501), the connection between computers made with the samehardware-based access barrier or firewall 50 c example that includes thesame buses or channels with on/off switches or equivalents as FIG. 4.

FIG. 6 shows an example embodiment of a personal computer 1 and/ormicrochip 90 (and/or 501) similar to FIGS. 23A and 23B of the '657Application, which showed multiple access barriers or firewalls 50 withprogressively greater protection, but with hardware-based accessbarriers or firewalls 50 c, 50 b, and 50 a used successively from ainner private unit 53, to an intermediate more private unit 53 ¹, and toan inner most private unit 53 ², respectively.

FIG. 7 shows a schematic illustration of a classic Von Neumann computerhardware architecture.

FIGS. 8-14 are additional architectural schematic embodiment examples of48the use of hardware-based access barriers or firewalls 50 a, 50 b, and50 c to create multiple compartments, as well as secure control busesand Faraday Cages.

FIGS. 15 and 16 illustrate methods in accordance with the presentdisclosure.

DETAILED DESCRIPTION OF THE EMBODIMENTS

FIGS. 1-4, 6, 8-14 all show useful architectural example embodiments ofany computer or microchip, including a personal computer 1 and/ormicrochip 90 (and/or 501) or silicon wafer (or graphene equivalent) 1500(wafer or wafer portion 1501, 1502, and/or 1503, as described in FIGS.19-26 and associated text of the '553 Application, which areincorporated by reference herein); tablets, smartphones, servers(including blades) and cloud or supercomputer arrays are other wellknown examples of computers. The computer shown has an innerhardware-based access barrier or firewall 50 establishing a securePrivate Unit (or zone or compartment) 53 that is directly controlled bya user 49 (local in this example) and disconnected by hardware from aPublic Unit (or zone or compartment) 54 that is connected to the open tothe public and insecure Internet 3 and/or another, intermediate network2; the connection of the computer 1 (and/or 90 and/or 501 and/or 1500 or1501, 1502, or 1503) to the network 2 and/or Internet 3 can be wired 99or wireless 100.

Hardware-based access barrier or firewall 50 (or 50 a, 50 b, or 50 c) asused in this application refers to an access barrier that includes oneor more access barrier or firewall-specific hardware and/or firmwarecomponents. This hardware and/or firmware configuration is in contrastto, for example, a computer firewall common in the art that includesonly software and general purpose hardware, such as an example limitedto firewall-specific software running on the single general purposemicroprocessor or CPU of a computer.

The Internet-disconnected Private Unit 53 includes a master controllingdevice 30 for the computer PC1 (and/or a master controller unit 93 forthe microchip 90 and/or 501) that can include a microprocessor orprocessing unit and thereby take the form of a general purposemicroprocessor or CPU, for one useful example, or alternatively onlycontrol the computer as a master controller 31 or master controller unit93′. The user 49 controls the master controlling device 30 (or 31 or 93or 93′) located in the Private Unit 53 and controls both the PrivateUnit 53 at all times and any part or all of the Public Unit 54selectively, but can peremptorily control any and all parts of thePublic Unit 54 at the discretion of the user 49 through activeintervention or selection from a range of settings, or based on standardcontrol settings by default, using for example a secure control bus 48(to be discussed later). The Public Unit 54 typically can include one ormore cores or general purpose microprocessors 40 or 94 and/orgraphics-based microprocessors 68 or 82 that are designed for moregeneral operations and not limited to graphics-related operations,including very large numbers of either or both types of microprocessors,and potentially including one or more secondary controllers 32, as wellas any number of specialized or single-function microprocessors.

The inner hardware-based access barrier or firewall has the capabilityof denying access to said protected portion of the computer 1 ormicrochip 90 by an insecure public network including the Internet, whilepermitting access by any other computer in the insecure public networkincluding the Internet to said one or more of the processing unitsincluded in the unprotected portion of the computer 1 or microchip 90for an operation with said any other computer in the insecure publicnetwork including the Internet when the computer is connected to theinsecure public network including the Internet. The operation can be anycomputer operation whatsoever involving some interaction between twocomputers including simply sending and/or receiving data and alsoincluding, but not limited to, specific examples such as searching,browsing, downloading, streaming, parallel processing, emailing,messaging, file transferring or sharing, telephoning or conferencing,and/or video conferencing.

More particularly, FIG. 1 shows a useful example of an optional (one ormore) closed and secure private non-Internet-connected network 52 forpersonal or local administration and/or management and/or control of thePrivate Unit 53. Wired 99 connection offers superior security generallyfor the closed and secure private network 52, but wireless 100connection is a option, especially if used with a sufficiently highlevel of encryption and/or other security measures, including low powerradio signals of high frequency and short range and/or directional.Access from the closed and private non-Internet-connected network 52 canbe limited to only a part of the Private Unit 53 or to multiple parts orto all of the Private Unit 53.

The closed and secure private non-Internet-connected network 52 (notconnected to the open and insecure public Internet 3 either directly orindirectly, such as through another, intermediate network like anIntranet 2) allows specifically for use as a highly secure and closedprivate network for providing administrative or management or controlfunctions like testing, maintenance, trouble-shooting, synchronizingfiles, modifying security, or operating or application system updates tothe Private Units 53 of any computers (PC1 or microchip 90 or 501) withone or more Public Units 54 that are connected to an insecure localnetwork 2, such as a business or home network, that is connected to thepublic Internet 3.

A particularly useful business example would be administering largenumbers of local employee personal computers or network servers, andalso including large arrays (especially blades) for cloud applicationsor supercomputer arrays with a vast multitude of microprocessors orlocal clusters; in the latter examples, it is possible for a centralizedoperator to use the secure private network 52 to control, securely anddirectly, the master controlling devices 30 or 31 or master controllerunit 93 or 93′ and associated memory or other devices in the PrivateUnits 53 of a multitude of servers, blades, or large arrays or clustersof computers that are connected to the Internet 3. A personal useexample would be to use a closed and secure private network 52 toconnect the private unit 53 of a personal user's smartphone to theprivate unit 53 of the user's computer laptop in order to update and/orsynchronize data or code between the two private units 53. To maximizesecurity, some or all network 52 traffic can be encrypted and/orauthenticated, especially if wireless 100, including with a very highlevel of encryption.

In addition, in another useful example, a computer (PC1 and/or 90 and/or501) can be configured so that the closed and secure privatenon-Internet-connected network 52 can have the capability to allow fordirect operational control of the Private Unit 53, and thus the entirecomputer, from any location (including a remote one), which can beuseful for example for businesses operating an array of servers likeblades to host cloud operations or supercomputers with large numbers ofmicroprocessors or cores.

One or more access barriers or firewalls 50 a, 50 b, or 50 c can belocated between the secure private non-Internet-connected network 52 andthe Private Unit 53 provides a useful example of increased securitycontrol.

In yet another useful example, a personal user 49 can dock hissmartphone (PC1 and/or 90 and/or 501 and/or 1500, 1501, 1502, or 1503)linking through wire or wirelessly to his laptop or desktop computer(PC1 and/or 90 and/or 501 and/or 1500, 1501, 1502, or 1503) in a network52 connection to synchronize the Private Units 53 of those two (or more)personal computers or perform other shared operations between thePrivate Units 53. In addition, the Public Units 54 of the user'smultiple personal computers can be synchronized simultaneously duringthe same tethering process, or perform other shared operations betweenthe Public Units 54. Other shared operations can be performed by the twoor more linked computers of the user 49 utilizing, for example, two orthree or more Private Units 53, each unit with one or more privatenon-Internet connected networks 52, while two or more Public Units 54can perform shared operations using one or more other networks 2,including the open and insecure Internet 3, as shown later in FIG. 6.

Also shown in FIG. 1 for personal computer PC1 embodiments is anoptional removable memory 47 located in the Private Unit 53; theremovable memory 47 can be of any form or type or number using any formof one or more direct connections to the Private Unit 53; a thumbdriveor SD card are typical examples, connected to USB, Firewire, or otherports or card slots. FIG. 1 shows as well an optional one or moreremovable keys 46, of which an access key, an ID authentication key, oran encryption and/or decryption key are examples, also connected to thePrivate Unit 53 using any form of connection, including the aboveexamples. For microchip 90 (and/or 501) embodiments, wireless connectionis a feasible option to enable one or more removable memories 47 or oneor more removable keys 46 (or combination of both), particularly for IDauthentication and/or access control. In addition, all or part of thePrivate Unit 53 of a computer PC1 and/or microchip 90 and/or 501 (orwafer 1500, 1501, 1502, or 1501 can be removable from the remainingportion of the same computer PC1 and/or microchip 90 and/or 501,including the Public Unit 54; the access control barrier or firewall 50(or 50 a and/or 50 b and/or 50 c) can be removable with the Private Unit53 or remain with Public Unit 54.

Similarly, FIG. 2 shows a useful architectural example embodiment of anycomputer or microchip, including a personal computer 1 and/or microchip90 and/or 501 (or wafer 1500, 1501, 1502, or 1503) with an innerhardware-based access barrier or firewall 50 separating a Private Unit53 that is disconnected by hardware from external networks 2 includingthe Internet 3 and a Public Unit 54 that is connected to externalnetworks including the Internet 3.

In terms of communication between the two Units in the example shown inFIG. 2, the Private Unit 53 and Public Unit 54 are connected only by aninner hardware-based access barrier or firewall 50 a in the form of asecure, out-only bus (or wire) or channel 55 that transmits data or codethat is output from the Private Unit 53 to be input to the Public Unit54. The user 49 controls the Private Unit 53-located master controllingdevice 30 (or 31 or 93 or 93′), which controls all traffic on the secureout-only bus or channel 55. Connections between the user 49 and themaster controlling device 30 (or 31 or 93 or 93′), as well as betweenthe master controlling device 30 (or 31 or 93 or 93′) and any componentcontrolled by it, can be for example hardwired on a motherboard (and/orexecuted in silicon on a microchip 90 and/or 501) to provide the highestlevel of security.

In the example shown in FIG. 2, there is no corresponding in-only bus orchannel 56 transmitting data or code that is output from the Public Unit54 to be input to the Private Unit 53. By this absence of any bus orchannel into the Private Unit 53, all access from the Internet 3 orintervening network 2 to the Private Unit 53 is completely blocked on apermanent basis. Another example is an equivalent wireless connectionbetween the two Units would require a wireless transmitter (and noreceiver) in the Private Unit 53 and a receiver (and no transmitter) inthe Public Unit 54, so the Private Unit 53 can only transmit data orcode to the Public Unit 54 and the Public Unit 54 can only receive dataor code from the Private Unit 53 (all exclusive of external wirelesstransmitters or receivers of the PC1 and/or microchip 90 and/or 501).

The Private Unit 53 can include any non-volatile memory, of whichread-only memory and read/write memory of which flash memory (and harddrives and optical drives) are examples, and any volatile memory, ofwhich DRAM (dynamic random access memory) is one common example.

An equivalent connection, such as a wireless (including radio and/oroptical) connection, to the out-only bus or channel 55 between the twoUnits 53 and 54 would require at least one wireless transmitter in thePrivate Unit 53 and at least one receiver in the Public Unit 54, so thePrivate Unit 53 can transmit data or code to the Public Unit 54 only(all exclusive of external wireless transmitters or receivers of the PC1and/or microchip 90 and/or 501).

An architecture for any computer or microchip (or nanochip) can have anynumber of inner hardware-based access barriers or firewalls 50 aarranged in any configuration.

FIG. 2 also shows an example embodiment of a firewall 50 located on theperiphery of the computer 1 and/or microchip 90 (and/or 501) controllingthe connection between the computer and the network 2 and Internet 3;the firewall 50 can be hardwire-controlled directly by the mastercontrolling device 30 (or 31 or 93 or 93′), for example.

FIG. 3 is a similar useful architectural example embodiment to thatshown in FIG. 2, but with the Private Unit 53 and Public Unit 54connected in terms of communication of data or code by an innerhardware-based access barrier or firewall 50 b example that includes asecure, out-only bus or channel 55. The connection between units alsoincludes an in-only bus or channel 56 that is capable of transmittingdata or code that is output from the Public Unit 54 to be input into thePrivate Unit 53, strictly controlled by the master controller 30 (and/or31 and/or 93 and/or 93′) in the Private Unit 53. The in-only bus orchannel 56 includes an input on/off switch (and/or microchip or nanochipcircuit equivalent) 57 that can break the bus 56 Public to Privateconnection between Units, the switch 57 being controlled by the PrivateUnit 53-located master controlling device 30 (or 31 or 93 or 93′), whichalso controls all traffic on the in-only bus or channel 56; the controlcan be hardwired.

For one example, the master controller 30 (or 31 or 93 or 93′) can bydefault use the on/off switch and/or micro-circuit (or nano-circuit)equivalent 57 to break the connection provided by the in-only bus orchannel 56 to the Private Unit 53 from the Public Unit 54 whenever thePublic Unit 54 is connected to the Internet 3 (or intermediate network2). In an alternate example, the master controller 30 (or 31 or 93 or93′) can use the on/off switch and/or micro or nano-circuit equivalent57 to make the connection provided by the in-only bus or channel 56 tothe Private Unit 53 only when very selective criteria or conditions havebeen met first, an example of which would be exclusion of all inputexcept when encrypted and from one of only a few authorized (andcarefully authenticated) sources, so that Public Unit 54 input to thePrivate Unit 53 is extremely limited and tightly controlled from thePrivate Unit 53.

Another example is an equivalent connection, such as a wireless(including radio and/or optical) connection, to the in-only bus orchannel 56 with an input on/off switch 57 between the two Units 53 and54 would require at least one wireless receiver in the Private Unit 53and at least one transmitter in the Public Unit 54, so the Private Unit53 can receive data or code from the Public Unit 54 while controllingthat reception of data or code by controlling its receiver, switching iteither “on” when the Public Unit 54 is disconnected from externalnetworks 2 and/or 3, for example, or “off” when the Public Unit 54 isconnected to external networks 2 and/or 3 (all exclusive of externalwireless transmitters or receivers of the PC1 and/or microchip 90 and/or501).

An architecture for any computer and/or microchip (or nanochip) can haveany number of inner hardware-based access barriers or firewalls 50 barranged in any configuration.

FIG. 4 is a similar useful architectural example embodiment to thatshown in FIGS. 2 and 3, but with Private Unit 53 and Public Unit 54connected in terms of communication of data or code by an innerhardware-based access barrier or firewall 50 c example that alsoincludes an output on/off switch and/or microcircuit equivalent 58 onthe secure out-only bus or channel 55, in addition to the input on/offswitch and/or microcircuit (or nano-circuit) equivalent 57 on thein-only bus or channel 56.

The output switch or microcircuit equivalent 58 is capable ofdisconnecting the Public Unit 54 from the Private Unit 53 when thePublic Unit 54 is being permitted by the master controller 30 (or 31 or93 or 93′) to perform a private operation controlled (completely or inpart) by an authorized third party user from the Internet 3, asdiscussed previously by the applicant relative to FIG. 17D andassociated textual specification of the '657 Application incorporatedabove. The user 49 using the master controller 30 (or 31 or 93 or 93′)always remains in preemptive control on the Public Unit 54 and can atany time for any reason interrupt or terminate any such thirdparty-controlled operation. The master controller 30 (or 31 or 93 or93′) controls both on/off switches 57 and 58 and traffic (data and code)on both buses or channels 55 and 56 and the control can be hardwired.

Another example is an equivalent connection, such as a wirelessconnection, to the in-only bus or channel 56 and out-only bus or channel55, each with an on/off switch 57 and 58 between the two Units 53 and54, would require at least one wireless transmitter and at least onereceiver in the Private Unit 53, as well as at least one transmitter andat least one receiver in the Public Unit 54, so the Private Unit 53 cansend or receive data or code to or from the Public Unit 54 by directlycontrolling the “on” or “off” state of its transmitter and receiver,controlling that flow of data or code depending, for example on thestate of external network 2 or Internet 3 connection of the Public Unit54 (again, all exclusive of external wireless transmitters or receiversof the PC1 and/or microchip 90 and/or 501).

An architecture for any computer and/or microchip (or nanochip) can haveany number of inner hardware-based access barriers or firewalls 50 carranged in any configuration.

FIG. 5 shows an architectural example embodiment of a first computer(personal computer 1 and/or microchip 90 and/or 501 or wafer 1500, or1501, 1502, or 1503) functioning as a Private Unit 53′ that is connectedto at least a second computer (or to a multitude of computers, includingpersonal computers 1 and/or microchips 90 and/or 501 or 1500, 1501,1502, or 1503) functioning as a Public Unit or Units 54′. The connectionbetween the private computer 53′ and the public computer or computers54′ is made including the same inner hardware-based access barrier orfirewall 50 c architecture that includes the same buses and channels 55and 56 with the same on/off switches 57 and 58 as previously describedabove in the FIG. 4 example above and can use the same hardwire control.Alternatively, inner hardware-based access barriers or firewalls 50 a or50 b can be used. In addition, inner hardware-based access barriers orfirewalls 50 a, 50 b, and 50 c can be used within the first and/orsecond computers.

The connection between the first and second computer can be anyconnection, including a wired network connection like the Ethernet, forexample, or a wireless network connection, similar to the examplesdescribed above in previous FIGS. 2-4. In the Ethernet example, eitheron/off switch 57 or 58 can be functionally replaced like in a wirelessconnection by control of an output transmitter or an input receiver oneither bus or channel 55 or 56; the transmitter or receiver being turnedon or off, which of course amounts functionally to mere locating theon/off switches 55 or 56 in the proper position on the bus or channel 55or 56 to control the appropriate transmitter or receiver, as is true forthe examples in previous figures.

FIG. 6 shows a useful architectural example embodiment of any computer(a personal computer 1 and/or microchip 90 and/or 501 or wafer 1500,1501, 1502, or 1503) similar to FIGS. 23A and 23B of the '657Application incorporated by reference above, which showed multiple innerfirewalls 50 with progressively greater protection. FIG. 6 shows anexample of an internal array of inner hardware-based access barriers orfirewalls 50 c, 50 b, and 50 a (described in previous FIGS. 2-4 above)used in a specific sequence between a public unit 54 and a first privateunit 53, between the first private unit 53 and a more private secondunit 53 ¹, and between the more private second unit 53 ¹ and a mostprivate third unit 53 ², respectively.

In addition, FIG. 6 shows a useful architectural example embodiment ofone or more master controllers-only C (31 or 93′) located in the mostprivate unit 53 ², with one or more microprocessors or processing unitsor “cores” S (40 or 94) located in the more private unit 53 ¹, in theprivate unit 53, and in the public unit 54. Each of the microprocessorsor processing units or cores S can have at least one secondarycontroller 32 with which it can be integrated, for example.

The microprocessors S (or processing units or cores) can be located inany of the computer units, but the majority in a many core architecturecan be in the public unit to maximize sharing and Internet use.Alternatively, for computers that are designed for moresecurity-oriented applications, a majority of the microprocessors S (orprocessing units or cores) can be located in the private units; anyallocation between the public and private units is possible. Any otherhardware, software, or firmware component or components can be locatedin the same manner as are microprocessors S (or master controllers-onlyC) described above.

An architecture for any computer and/or microchip or nanochip can haveany number of inner hardware-based access barriers or firewalls 50 aand/or 50 b and/or 50 c arranged in any combination or configuration.

As shown in FIG. 6, the private non-Internet network 52, which wasdiscussed previously relative to FIG. 1, can consist in an exampleembodiment of more than one network, with each additional non-Internetnetwork 52 being used to connect Private Units 53 ², 53 ¹, and 53 of onecomputer and/or microchip to separate non-Internet networks 52 ², 52 ¹and 52, respectively, and that are connected to Private Units 53 ², 53¹, and 53, respectively, of other computers and/or microchips. That is,each computer and/or microchip Private Unit 53 ², 53 ¹, and 53 can haveits own separate, non-Internet network 52 ², 52 ¹, and 52, respectively,and so that any Private Unit can be connected to other computer PC1and/or microchip 90 (and/or 501) units of the same level of security;any Private Unit can also be subdivided into subunits of the same levelof security. This is a useful embodiment example for making relativelylocal connections from business or home networks and scales up to largebusiness servers, cloud, or supercomputers applications. The connectionscan be wired or wireless and local or non-local.

Similarly, a computer PC1 and/or microchip 90 or 501 Public Unit 54 canbe subdivided into a number of different levels of security, forexample, and each subdivided Public Unit 54 can have a separate,non-Internet connected network 52; and a subdivided Public Unit 54 canbe further subdivided with the same level of security. In addition, anyhardware component (like a hard drive or Flash memory device (andassociated software or firmware), within a private (or public) unit of agiven level of security can be connected by a separate non-Internetnetwork 52 to similar components within a private (or public) unit ofthe same level of security.

Any configuration of access barriers or firewalls 50 a and/or 50 band/or 50 c can be located between any of the privatenon-Internet-connected networks 52 ², 52 ¹, and 52, and the PrivateUnits 53 ², 53 ¹, and 53, respectively, providing a useful example ofincreased security control as shown in FIG. 6.

Also shown in the example embodiment of FIG. 6, each Private Unit 53 ²,53 ¹, and 53 can have one or more ports (or connections to one or moreports), like for a USB connection to allow for the use of one or moreoptional removable access and/or encryption or other keys 46, and/or oneor more optional removable memory (such as a USB Flash memorythumbdrive) or other device 47, both of which as discussed previously inthe text of FIG. 1, which example can also have one or more ports foreither 46 and/or 47 and/or other device. The Public Unit 54 can alsohave one or more of any such removable devices, or ports like a USB portto allow for them.

Any data or code or system state, for example, for any Public or PrivateUnit 54 or 53 can be displayed to the personal user 49 and can be shownin its own distinctive color or shading or border (or any other visualor audible distinctive characteristic, like the use of flashing text).FIG. 6 shows an example embodiment of different colors indicated foreach of the Units.

For embodiments requiring a higher level of security, it may bepreferable to eliminate permanently or temporarily block (by default orby user choice, for example) the non-Internet network 52 ² and all portsor port connections in the most private unit 53 ².

The public unit 54 can be subdivided into an encrypted area (and caninclude encryption/decryption hardware) and an open, unencrypted area,as can any of the private units 53; in both cases the master centralcontroller 30, 31, 93, or 93′ can control the transfer of any or allcode or data between an encrypted area and an unencrypted areaconsidering factors such authentication.

The invention example structural and functional embodiments shown in theabove described FIGS. 1-6, as well as the following FIGS. 7-16 and theassociated textual specification of this application all most directlyrelate to the example structural and functional embodiments of the innerfirewall 50 described in FIGS. 10A-10D, 10J-10Q, 17A-17D, 23A-23E, 24,25A-25D and 27A-27G, and associated textual specification, of the above'657 Application incorporated by reference.

FIG. 7 shows the fundamental security problem caused by the Internetconnection to the classic Von Neumann computer hardware architecturethat was created in 1945. At that time there were no other computers andtherefore no networks of even the simplest kind, so network security wasnot a consideration in its fundamental design, which is unsafe for usewhen connected to an open insecure public network of enormous scale,such as the Internet.

FIGS. 8-14 are useful architectural example embodiments of the innerhardware-based access barriers or firewalls 50 a, 50 b, and 50 c.

FIG. 8 shows a useful example embodiment of the applicant's basicarchitectural solution to the fundamental security problem caused by theInternet, the solution being to protect the central controller of thecomputer with an inner firewall 50 controlling access by the Internet,as discussed in detail in FIGS. 10A-10D and 10J-10Q, and associatedtextual specification of the '657 Application, those specific drawingand text portions of which are incorporated by reference in thisapplication; they were discussed as well as earlier in this application.FIG. 8 and subsequent figures describe example embodiments of a numberof specific forms of an inner hardware-based access barrier or firewall50, such as access barriers or firewalls 50 a and/or 50 b and/or 50 c asdescribed previously in this application; the number and potentialconfigurations of access barriers or firewalls 50 a and/or 50 b and/or50 c within any computer, such as computer PC 1 and/or microchip 90(and/or 501) is without any particular limit.

FIG. 9 is a similar embodiment to FIG. 8, but also showing a usefularchitectural example of a central controller integrated with amicroprocessor to form a conventional general purpose microprocessor orCPU (like an Intel ×86 microprocessor, for example). FIG. 8 also shows acomputer PC1 and/or microchip 90 and/or 501 with many microprocessors orcores.

FIG. 10 is the same embodiment as FIG. 9, but also shows a majorfunctional benefit of the applicant's access barrier or firewall 50 a,50 b, and 50 c invention, which is to enable a function to flush awayInternet malware by limiting the memory access of malware to DRAM 66(dynamic random access memory) in the Public Unit 54, which is a usefulexample of a volatile memory that can be easily and quickly erased bypower interruption. The flushing function of a firewall 50 was discussedearlier in detail in FIGS. 25A-25D and associated textual specificationof the '657 Application and those specific drawing and text portions ofthe '657 Application are incorporated by reference herein.

FIG. 11 is a useful example embodiment similar to FIG. 6 and shows thatany computer or microchip can be partitioned into many different layersof public units 54 and private units 53 using an architecturalconfiguration of access barriers or firewalls 50 a, 50 b, and 50 c; thenumber and arrangement of potential configurations is without anyparticular limit; and the number of microprocessors 40 or 94 and/or 68or 82 in the public unit 53 can be potentially any number, including 1or 2 or 3 or at least 4 or 8 or 16 or 32 or 64 or 128 or 256 or 512 or1024 or many more, as could potentially be the case in prior orsubsequent figures. The partition architecture provided by firewalls 50was discussed earlier in detail in FIGS. 23A-23B and associated textualspecification of the '657 Application and those specific drawing andtext portions are incorporated by reference herein.

FIG. 12 is another useful architectural example embodiment of thelayered use of access barriers or firewalls 50, 50 c, 50 b, and 50 cbased on a kernel or onion structure; the number of potentialconfigurations including relative to layers or types of access barriersor firewalls is without any particular limit. This structure wasdiscussed in detail relative to firewalls 50 in FIGS. 23D-23E andassociated textual specification of the '657 Application and thosespecific drawing and text portions are incorporated by reference herein.

FIG. 13 is a useful architectural example embodiment showing thepresence of many FIG. 12 example embodiments with layered accessbarriers or firewalls 50 a, 50 b, and 50 c structures on all of the manyhardware, software, and/or firmware components of a computer; the numberof FIG. 12 embodiments or their potential configurations includingrelative to layers or types of access barriers or firewalls is withoutany particular limit in either the private unit 53 or the public unit 54of any computer or microchip. The many layered kernels structure wasdiscussed in more detail in FIG. 23C and associated textualspecification of the '657 Application and those specific drawing andtext portions are incorporated by reference earlier. Note that anysubcomponent or kernel of the FIG. 12 example embodiment can beprotected by a hardware-based access barrier 50 a (or 50 b or 50 c or50), a secure, out-only bus or channel 55, and therefore can for examplebe effectively disconnected from any input from any network, includingeither the secure private network 52 and the insecure public networkincluding the Internet 3.

FIG. 14 is a useful architectural example embodiment similar to FIG. 13,but also showing the computer PC1 and/or microchip 90 and/or 501surrounded by a Faraday Cage 300; the number of potential similarconfigurations is without any particular limit. This use of FaradayCages 300 was discussed in detail in FIGS. 27A-27G and associatedtextual specification of the '657 Application and those specific drawingand text portions are incorporated by reference herein.

FIG. 14 shows a useful example embodiment of a Faraday Cage 300surrounding completely a computer PC1 and/or microchip 90 and/or 501.The Faraday Cage 300 can be subdivided by an example partition 301 toprotect and separate the Private Unit 53 from the Public Unit 54, sothat the Private Unit 53 is completely surrounded by Faraday Cage 300 ¹and Public Unit 54 is completely surrounded by Faraday Cage 300 ², inthe example embodiment shown. Each unit can alternatively have adiscrete Faraday Cage 300 of its own, instead of partitioning a largerFaraday Cage 300 and the surrounding of a Unit can be complete orpartial. Any number or configuration of Faraday Cages can be used in themanner shown generally in FIG. 14, including a separate Faraday Cage forany hardware component of the computer or microchip.

The example embodiments shown in FIGS. 1-4, 6-11, and 13-16 are acomputer of any sort, including a personal computer PC1; or a microchip90 or 501, including a microprocessor or a system on a chip (SoC) suchas a personal computer on a microchip 90; or a combination of both, suchas a computer with the architecture shown in FIGS. 1-4, 6-11, and 13-16,the computer also including one or more microchips also with thearchitecture shown in FIGS. 1-4, 6-11, and 13-16.

The Public Unit 54 shown in FIGS. 1-6, 8-11, and 13-14 can be used in auseful embodiment example to run all or a part of any application (or“apps”) downloaded from the Internet or Web, such as the example of anyof the many thousands of apps for the Apple iPhone that are downloadedfrom the Apple Apps Store, or to run applications that are streamed fromthe Internet or Web. Similarly, all or part of a video or audio filelike a movie or music can be downloaded from the Web and played in thePublic Unit 54 for viewing and/or listening be the computer user 49.

Some or all personal data pertaining to a user 49 can be keptexclusively on the user's computer PC1 and/or microchip 90 and/or 501for any cloud application or app to protect the privacy of the user 49(or kept non-exclusively as a back-up), unlike conventional cloud apps,where the data of a personal user 49 is kept in the cloud andpotentially intentionally shared or carelessly compromised withoutauthorization by or knowledge of the personal user 49. In effect, thePublic Unit 54 can be a safe and private local cloud, with personalfiles retained there or in the Private Unit 53. All or part of an appcan also potentially be downloaded or streamed to one or more PrivateUnits, including 53 ², 53 ¹, and 53.

Privacy in conventional clouds can also be significantly enhanced usingthe inner hardware-based access barriers or firewalls 50 a and/or 50 band/or 50 c described in this application, since each individual orcorporate user of the cloud can be assured that their data is safebecause it can be physically separated and segregated by hardware,instead of by software alone, as is the case currently.

Similarly, the example embodiment of FIG. 6 shows a computer and/ormicrochip Public Unit 54 and Private Units 53, 53 ¹, and 53 ², each witha separate Faraday Cage. 300 ⁴, 300 ³, 300 ², and 300 ¹, respectively,that are created using partitions 301 ^(c), 301 ^(b), and 301 ^(a),respectively. Any Public Unit 54 or Private Unit 53 can be protected byits own Faraday Cage 300. The Faraday Cage 300 can completely orpartially surround the any Unit in two or three dimensions.

FIGS. 8-11 and 13-14 also show example embodiments of a secure controlbus (or wire or channel) 48 that connects the master controlling device30 (or 31) or master control unit 93 (or 93′) or central controller (asshown) with the components of the computer PC1 and/or microchip 90and/or 501, including those in the Public Unit 54. The secure controlbus 48 provides hardwired control of the Public Unit 54 by the centralcontroller in the Private Unit 53. The secure control bus 48 can beisolated from any input from the Internet 3 and/or an intervening othernetwork 2 and/or from any input or monitoring from any or all parts ofthe Public Unit 54. The secure control bus 48 can provide and ensuredirect preemptive control by the central controller over any or all thecomponents of the computer, including the Public Unit 54 components. Thesecure control bus 48 can, partially or completely, coincide or beintegrated with the bus 55, for example. The secure control bus 48 isconfigured in a manner such that it cannot be affected, interfered with,altered, read or written to, or superseded by any part of the PublicUnit 54 or any input from the Internet 3 or network 2, for example. Awireless connection can also provide the function of the secure controlbus 48 in a manner similar to that describing wireless connections abovein FIGS. 2-6 describing buses 55 and 56.

The secure control bus 48 can also provide connection for the centralcontroller to control a conventional firewall or for example accessbarrier or firewall 50 c located on the periphery of the computer ormicrochip to control the connection of the computer PC1 and/or microchip90 and/or 501 to the Internet 3 and/or intervening other network 2.

The secure control bus 48 can also be used by the master centralcontroller 30, 31, 93, or 93′ to control one or more secondarycontrollers 32 located on the bus 48 or anywhere in the computer PC1and/or microchip 90 and/or 501, including in the Public Unit 54 that areused, for example, to control microprocessors or processing units orcores S (40 or 94) located in the Public Unit 54. The one or moresecondary controllers 32 can be independent or integrated with themicroprocessors or processing units or cores S (40 or 94) shown in FIGS.9 and 11 above, for example; such integrated microprocessors can be aspecial purpose design or a common general purpose microprocessors likean Intel x86 microprocessor, for example.

In accordance with the present disclosure, a method of protecting acomputer is disclosed in FIG. 15. The computer includes may include amaster controlling device that is configured using hardware andfirmware; at least two general purpose microprocessors; a protectedportion of the computer; an unprotected portion of the computer; and aninner hardware-based access barrier or firewall that is located betweenthe protected portion of the computer and the unprotected portion of thecomputer, the protected portion including at least the mastercontrolling device and at least one of the microprocessors, and theunprotected portion including at least one of the microprocessors, theat least one microprocessor of the unprotected portion being separatefrom and located outside of the inner hardware-based access barrier orfirewall. As shown in FIG. 15, the method of protecting a computerincludes connecting a first portion of the computer through at least afirst connection to at least a private network of computers (150);connecting a second portions of the computer through a second connectionto at least a public network of computers including the Internet (152);controlling the first and second portions of the computer from the firstportion through the private network (154); and performing operations inthe second portion using the public network (156).

In accordance with the present disclosure, a method of protecting acomputer is disclosed in FIG. 16. The computer may include a mastercontrolling device that is configured using hardware and firmware; atleast two general purpose microprocessors; a protected portion of thecomputer; an unprotected portion of the computer; and an innerhardware-based access barrier or firewall that is located between theprotected portion of the computer and the unprotected portion of thecomputer, the protected portion including at least the mastercontrolling device and at least one of the microprocessors, and theunprotected portion including at least one of the microprocessors, theat least one microprocessor of the unprotected portion being separatefrom and located outside of the inner hardware-based access barrier orfirewall. As shown in FIG. 16, the method includes allowing a user ofthe computer to control the microprocessors (160); connecting theprotected portion of the computer through a first connection to at leasta secure private network of computers (162); connecting the unprotectedportion of the computer through a second connection to an insecurepublic network of computers including the Internet (164); denying accessby the hardware-based access barrier or firewall to the protectedportion of the computer by the insecure public network when the personalcomputer is connected to the insecure public network (166); andpermitting access by any other computer in the insecure public networkto the one or more of the processing units included in the unprotectedportion of the computer for an operation with the any other computer inthe insecure public network when the personal computer is connected tothe insecure public network (168).

Any one or more features or components of FIGS. 1-16 of this applicationcan be usefully combined with one or more features or components ofFIGS. 1-31 of the above '657 U.S. Application or FIGS. 1-27 of the above'769 U.S. application. Each of the above '657 and '769 applications andtheir associated U.S. publications are expressly incorporated byreference in its entirety for completeness of disclosure of theapplicant's combination of one or more features or components of eitherof those above two prior applications of this applicant with one or morefeatures or components of this application. All such useful possiblecombinations are hereby expressly intended by this applicant.

Furthermore, any one or more features or components of FIGS. 1-16 ofthis application can be usefully combined with one or more features orcomponents of the figures of the above '049 and '553 U.S. applications,as well as in the above '428, '250, '141, '449, '906, '275, '020, '854,'529, '756, and '233 U.S. patents. Each of the above '049 and '553applications and their associated U.S. publications, as well as theabove '428, '250, '141, '449, '906, '275, '020, '854, '529, '756, and'233 U.S. patents are expressly incorporated by reference in itsentirety for completeness of disclosure of the applicant's combinationof one or more features or components of either of those above two priorapplications of this applicant with one or more features or componentsof this application. All such useful possible combinations are herebyexpressly intended by this applicant.

In addition, one or more features or components of any one of FIGS. 1-16or associated textual specification of this application can be usefullycombined with one or more features or components of any one or moreother of FIGS. 1-16 or associated textual specification of thisapplication. And any such combination derived from the figures orassociated text of this application can also be combined with anyfeature or component of the figures or associated text of any of theabove incorporated by reference U.S. applications '657, '769, '049, and'553, as well as U.S. Pat. Nos. '428, '250, '141, '449, '906, '275,'020, '854, '529, '756, and '233.

1. A method of securely controlling through two private networks acomputer configured to operate as a general purpose computer andconfigured for connection to the Internet, said computer comprising: atleast one network connection configured for connection to at least apublic network of computers including the Internet, said at least onenetwork connection being located in at least one public unit of saidcomputer, at least an additional and separate first private networkconnection configured for connection to at least a separate, firstprivate network of computers, at least said first separate privatenetwork connection being located in at least a first protected privateunit of said computer, and at least a first inner hardware-based accessbarrier or inner hardware-based firewall that is located between andcommunicatively connects at least said first protected private unit ofsaid computer and said at least one public unit of said computer;wherein said first private unit, said public unit and said two separatenetwork connections are separated by at least said first innerhardware-based access barrier or inner hardware-based firewall; at leastsaid first protected private unit of the computer includes at least afirst microprocessor or core or processing unit, said at least onepublic unit of the computer includes at least a second microprocessor orcore or processing unit, configured to operate as a general purposemicroprocessor or core or processing unit, said second microprocessor orcore or processing unit is separate from said first inner hardware-basedaccess barrier or inner hardware-based firewall, at least a separate,second inner hardware-based access barrier or inner hardware-basedfirewall that protects at least a separate, second private networkconnection configured for connection to at least a separate, secondprivate network of computers, at least said second private networkconnection being located in at least a second protected private unit ofsaid computer; and said second protected private unit of the computerincludes at least a third microprocessor or core or processing unit; andsaid method comprising the steps of: controlling at least one operationof said computer from said first private network of computers, saidoperation including at least transmitting data and/or code from saidfirst private network of computers to said first separate privatenetwork connection in said first protected private unit of saidcomputer; receiving said data and/or code by said first microprocessoror core or processing unit in said first protected private unit of saidcomputer; transmitting data and/or code by said first microprocessor orcore or processing unit in said first protected private unit to at leasta part of said public unit; controlling at least one operation of saidcomputer from said second private network of computers, said operationincluding at least transmitting data and/or code from said secondprivate network of computers to said second private network connectionin said second protected private unit of said computer; and receivingsaid data and/or code in at least a part of said second protectedprivate unit of said computer from said second private network ofcomputers, said part of said second protected private unit including atleast said third microprocessor or core or processing unit; andtransmitting data and/or code by said third microprocessor or core orprocessing unit through said second inner hardware-based access barrieror inner hardware-based firewall to at least a part of said public unitor said first protected private unit.
 2. The method of claim 1, whereinat least one said controlling step includes remotely controlling saidcomputer.
 3. The method of claim 1, wherein at least one saidcontrolling step includes remotely providing administrative functionsfor said computer.
 4. The method of claim 3, wherein at least one saidcontrolling step includes remotely maintaining the computer, remotelytesting the computer, or remotely updating an operating or applicationsystem of said computer.
 5. The method of claim 3, wherein at least onesaid controlling step includes performing at least one operation in thepublic unit of said computer.
 6. The method of claim 1, wherein saidcomputer further comprises: at least a separate, third innerhardware-based access barrier or inner hardware-based firewall thatprotects at least a separate, third private network connectionconfigured for connection to at least a separate, third private networkof computers, said at least a third private network connection beinglocated in at least a third protected private unit of said computer;said third protected private unit of the computer includes at least afourth microprocessor or core or processing unit, said method furthercomprising the steps of: controlling at least one operation of saidcomputer from said third private network of computers, said operationincluding at least transmitting data and/or code from said third privatenetwork of computers to said third private network connection in saidthird protected private unit of said computer; and receiving said dataand/or code in at least a part of said third protected private unit ofsaid computer from said third private network of computers, said part ofsaid third protected private unit including at least said fourthmicroprocessor or core or processing unit; and transmitting data and/orcode by said fourth microprocessor or core or processing unit throughsaid third inner hardware-based access barrier or inner hardware-basedfirewall to at least a part of said public unit or said first or secondprotected private unit.
 7. A method of securely controlling through twoprivate networks a computer configured to operate as a general purposecomputer and configured for connection to the Internet, said computercomprising: at least one network connection configured for connection toat least a public network of computers including the Internet, said atleast one network connection being located in at least one public unitof said computer, at least an additional and separate first privatenetwork connection configured for connection to at least a separate,first private network of computers, at least said first separate privatenetwork connection being located in at least a first protected privateunit of said computer, and at least a first inner hardware-based accessbarrier or inner hardware-based firewall that is located between andcommunicatively connects at least said first protected private unit ofsaid computer and said at least one public unit of said computer;wherein said first private unit, said public unit and said two separatenetwork connections are separated by at least said first innerhardware-based access barrier or inner hardware-based firewall; at leastsaid first protected private unit of the computer includes at least afirst microprocessor or core or processing unit, said at least onepublic unit of the computer includes at least a second microprocessor orcore or processing unit, configured to operate as a general purposemicroprocessor or core or processing unit, said second microprocessor orcore or processing unit is separate from said first inner hardware-basedaccess barrier or inner hardware-based firewall, at least a separate,second inner hardware-based access barrier or inner hardware-basedfirewall that protects at least a separate, second private networkconnection configured for connection to at least a separate, secondprivate network of computers, at least said second private networkconnection being located in at least a second protected private unit ofsaid computer; and said second protected private unit of the computerincludes at least a third microprocessor or core or processing unit;said second protected private unit of said computer being locatedbetween said first protected private unit and said public unit of saidcomputer; and said method comprising the steps of: controlling at leastone operation of said computer from said second private network ofcomputers, said operation including at least transmitting data and/orcode from said second private network of computers to said secondseparate private network connection in said second protected privateunit of said computer; receiving said data and/or code in at least apart of said second protected private unit of said computer from saidsecond private network of computers, said part of said second protectedprivate unit including at least said third microprocessor or core orprocessing unit; and transmitting data and/or code by said thirdmicroprocessor or core or processing unit through said second innerhardware-based access barrier or firewall to at least a part of saidpublic unit or said first protected private unit.
 8. The method of claim7, wherein at least one said controlling step includes remotelycontrolling said computer.
 9. The method of claim 7, wherein at leastone said controlling step includes remotely providing administrativefunctions for said computer.
 10. The method of claim 9, wherein at leastone said controlling step includes remotely maintaining the computer,remotely testing the computer, or remotely updating an operating orapplication system of said computer.
 11. The method of claim 9, whereinat least one said controlling step includes performing at least oneoperation in the public unit of said computer.
 12. The method of claim7, wherein said computer further comprises: at least a separate, thirdinner hardware-based access barrier or inner hardware-based firewallthat protects at least a separate, third private network connectionconfigured for connection to at least a separate, third private networkof computers, said at least a third private network connection beinglocated in at least a third protected private unit of said computer;said third protected private unit of the computer includes at least afourth microprocessor or core or processing unit, said method furthercomprising the steps of: controlling at least one operation of saidcomputer from said third private network of computers, said operationincluding at least transmitting data and/or code from said third privatenetwork of computers to said third private network connection in saidthird protected private unit of said computer; and receiving said dataand/or code in at least a part of said third protected private unit ofsaid computer from said third private network of computers, said part ofsaid third protected private unit including at least said fourthmicroprocessor or core or processing unit; and transmitting data and/orcode by said fourth microprocessor or core or processing unit throughsaid third inner hardware-based access barrier or inner hardware-basedfirewall to at least a part of said public unit or said first or secondprotected private unit.
 13. A method for an operator using at least oneprivate network to securely control at least two computers of at leastone cloud or other array or cluster of two or more computers, saidcomputers being configured to operate as general purpose computers andconfigured for connection to the Internet, each of said at least twocomputers comprising: at least one network connection configured forconnection to at least a public network of computers including theInternet, said at least one network connection being located in at leastone public unit of said computer, at least one additional and separateprivate network connection configured for connection to at least aseparate, private network of computers, said at least one additional andseparate private network connection being located in at least oneprotected private unit of said computer, and at least one innerhardware-based access barrier or inner hardware-based firewall that islocated between and communicatively connects said at least one protectedprivate unit of said computer and said at least one public unit of saidcomputer; wherein said private and public units and said two separatenetwork connections are separated by said at least one innerhardware-based access barrier or inner hardware-based firewall; said atleast one protected private unit of the computer includes at least afirst microprocessor or core or processing unit, said at least onepublic unit of the computer includes at least a second microprocessor orcore or processing unit, configured to operate as a general purposemicroprocessor or core or processing unit, and said secondmicroprocessor or core or processing unit is separate from said innerhardware-based access barrier or inner hardware-based firewall; and saidmethod comprising the steps of: controlling at least one operation ofeach of said at least two computers from said private network ofcomputers, said operation including at least transmitting data and/orcode from said operator through said private network of computers tosaid separate private network connection in said protected private unitof each of said at least two computers; receiving said data and/or codeby said first microprocessor or core or processing unit in saidprotected private unit of each of said at least two computers; andtransmitting data and/or code by said first microprocessor or core orprocessing unit in said protected private unit to at least a part ofsaid public unit of each of said at least two computers.
 14. The methodof claim 13, wherein said controlling step includes remotely controllingsaid computer.
 15. The method of claim 13, wherein said controlling stepincludes remotely providing administrative functions for said computer.16. The method of claim 15, wherein said controlling step includesremotely maintaining the computer, remotely testing the computer, orremotely updating an operating or application system of said computer.17. The method of claim 16, wherein said computer further comprises: atleast a separate, second inner hardware-based access barrier or innerhardware-based firewall that protects at least a separate, secondprivate network connection configured for connection to at least aseparate, second private network of computers, said at least a secondprivate network connection being located in at least a second protectedprivate unit of said computer; said second protected private unit of thecomputer includes at least a third microprocessor or core or processingunit, said method further comprising the steps of: controlling at leastone operation of said computer from said second private network ofcomputers, said operation including at least transmitting data and/orcode from said second private network of computers to said secondprivate network connection in said second protected private unit of saidcomputer; and receiving said data and/or code in at least a part of saidsecond protected private unit of said computer from said second privatenetwork of computers, said part of said second protected private unitincluding at least said third microprocessor or core or processing unit;and transmitting data and/or code by said third microprocessor or coreor processing unit through said second inner hardware-based accessbarrier or inner hardware-based firewall to at least a part of saidpublic unit or said first protected private unit.
 18. The method ofclaim 17, wherein said computer further comprises: at least a separate,third inner hardware-based access barrier or inner hardware-basedfirewall that protects at least a separate, third private networkconnection configured for connection to at least a separate, thirdprivate network of computers, said at least a third private networkconnection being located in at least a third protected private unit ofsaid computer; said third protected private unit of the computerincludes at least a fourth microprocessor or core or processing unit,said method further comprising the steps of: controlling at least oneoperation of said computer from said third private network of computers,said operation including at least transmitting data and/or code fromsaid third private network of computers to said third private networkconnection in said third protected private unit of said computer; andreceiving said data and/or code in at least a part of said thirdprotected private unit of said computer from said third private networkof computers, said part of said third protected private unit includingat least said fourth microprocessor or core or processing unit; andtransmitting data and/or code by said fourth microprocessor or core orprocessing unit through said third inner hardware-based access barrieror inner hardware-based firewall to at least a part of said public unitor said first or second protected private unit.
 19. The method of claim15, wherein said controlling step includes performing at least oneoperation in the public unit of said computer.
 20. A method of at leasta first computer securely controlling through a private network at leasta second computer, said computers including personal computers, tablets,smartphones, or other general purpose computers and said computers beingconfigured for connection to the Internet, each of said computerscomprising: at least one network connection configured for connection toat least a public network of computers including the Internet, said atleast one network connection being located in at least one public unitof said computer, at least one additional and separate private networkconnection configured for connection to at least a separate, privatenetwork of computers, said at least one additional and separate privatenetwork connection being located in at least one protected private unitof said computer, and at least one inner hardware-based access barrieror inner hardware-based firewall that is located between andcommunicatively connects said at least one protected private unit ofsaid computer and said at least one public unit of said computer;wherein said private and public units and said two separate networkconnections are separated by said at least one inner hardware-basedaccess barrier or inner hardware-based firewall; said at least oneprotected private unit of the computer includes at least a firstmicroprocessor or core or processing unit, said at least one public unitof the computer includes at least a second microprocessor or core orprocessing unit, configured to operate as a general purposemicroprocessor or core or processing unit, and said secondmicroprocessor or core or processing unit is separate from said innerhardware-based access barrier or inner hardware-based firewall; and saidmethod comprising the steps of: controlling by at least said firstcomputer at least one operation of said second computer through saidprivate network of computers, said control including at leasttransmitting data and/or code by said first microprocessor or core orprocessing unit in said protected private unit of at least said firstcomputer to said separate private network connection in said protectedprivate unit of at least said first computer; transmitting data and/orcode from said separate private network connection in said protectedprivate unit of at least said first computer through said privatenetwork of computers to said separate private network connection in saidprotected private unit of at least said second computer; and receivingsaid data and/or code by said first microprocessor or core or processingunit in said protected private unit of at least said second computerfrom said separate private network connection in said protected privateunit of at least said second computer; and transmitting said data and/orcode by said first microprocessor or core or processing unit in saidprotected private unit to at least a part of said public unit in saidsecond computer.
 21. The method of claim 20, wherein said controllingstep includes remotely controlling said computer.
 22. The method ofclaim 20, wherein said controlling step includes remotely providingadministrative functions for said computer.
 23. The method of claim 22,wherein said controlling step includes remotely maintaining thecomputer, remotely testing the computer, or remotely updating anoperating or application system of said computer.
 24. The method ofclaim 23, wherein each of said computers further comprises: at least aseparate, second inner hardware-based access barrier or innerhardware-based firewall that protects at least a separate, secondprivate network connection configured for connection to at least aseparate, second private network of computers, said at least a secondprivate network connection being located in at least a second protectedprivate unit of each said computer; said second protected private unitof each said computer includes at least a third microprocessor or coreor processing unit, said method further comprising the steps of:controlling at least one operation of at least one of said computersfrom said second private network of computers, said operation includingat least transmitting data and/or code from said second private networkof computers to said second private network connection in said secondprotected private unit of said at least one computer; and receiving saiddata and/or code in at least a part of said second protected privateunit of said at least one computer from said second private network ofcomputers, said part of said second protected private unit including atleast said third microprocessor or core or processing unit; andtransmitting data and/or code by said third microprocessor or core orprocessing unit through said second inner hardware-based access barrieror inner hardware-based firewall to at least a part of said public unitor said first protected private unit of said at least one computer. 25.The method of claim 24, wherein each said computer further comprises: atleast a separate, third inner hardware-based access barrier or innerhardware-based firewall that protects at least a separate, third privatenetwork connection configured for connection to at least a separate,third private network of computers, said at least a third privatenetwork connection being located in at least a third protected privateunit of each said computer; said third protected private unit of eachsaid computer includes at least a fourth microprocessor or core orprocessing unit, said method further comprising the steps of:controlling at least one operation of at least one said computer fromsaid third private network of computers, said operation including atleast transmitting data and/or code from said third private network ofcomputers to said third private network connection in said thirdprotected private unit of said at least one computer; and receiving saiddata and/or code in at least a part of said third protected private unitof said at least one computer from said third private network ofcomputers, said part of said third protected private unit including atleast said fourth microprocessor or core or processing unit; andtransmitting data and/or code by said fourth microprocessor or core orprocessing unit through said third inner hardware-based access barrieror inner hardware-based firewall to at least a part of said public unitor said first or second protected private unit of said at least onecomputer.
 26. The method of claim 22, wherein said controlling stepincludes performing at least one operation in the public unit of saidcomputer.
 27. A method of at least a first computer securely controllingthrough a private network at least a second computer, said computersbeing configured for connection to the Internet, each of said computerscomprising: at least one network connection configured for connection toat least a public network of computers including the Internet, said atleast one network connection being located in at least one public unitof said computer, at least one additional and separate private networkconnection configured for connection to at least a separate, privatenetwork of computers, said at least one additional and separate privatenetwork connection being located in at least one protected private unitof said computer, and at least one inner hardware-based access barrieror inner hardware-based firewall that is located between andcommunicatively connects said at least one protected private unit ofsaid computer and said at least one public unit of said computer;wherein said private and public units and said two separate networkconnections are separated by said at least one inner hardware-basedaccess barrier or inner hardware-based firewall; said at least oneprotected private unit of the computer includes at least a firstmicroprocessor or core or processing unit, said at least one public unitof the computer includes at least a second microprocessor or core orprocessing unit, configured to operate as a general purposemicroprocessor or core or processing unit, and said secondmicroprocessor or core or processing unit is separate from said innerhardware-based access barrier or inner hardware-based firewall; and saidmethod comprising the steps of: controlling by at least said firstcomputer at least one operation of said second computer through saidprivate network of computers, said control including at leasttransmitting data and/or code by said first microprocessor or core orprocessing unit in said protected private unit of at least said firstcomputer to said separate private network connection in said protectedprivate unit of at least said first computer; transmitting data and/orcode from said separate private network connection in said protectedprivate unit of at least said first computer through said privatenetwork of computers to said separate private network connection in saidprotected private unit of at least said second computer; and receivingsaid data and/or code by said first microprocessor or core or processingunit in said protected private unit of at least said second computerfrom said separate private network connection in said protected privateunit of at least said second computer; and transmitting said data and/orcode by said first microprocessor or core or processing unit in saidprotected private unit to at least a part of said public unit in saidsecond computer.